Checkmarx One Reviews

We are using Checkmarx for analyzing threats.

We are not using the latest version of Checkmarx because we faced some issues.

Checkmarx needs to improve the false positives and provide more accuracy in identifying vulnerabilities. It misses important vulnerabilities.

SonarCube functions better in these areas.

I have used Checkmarx within the last 24 months.

The stability of Checkmarx could improve.

I would rate the stability of Checkmarx a six out of ten.

The solution is scalable, but other solutions are better.

We have 20 developers using this solution. We have a few projects left to use this solution and then we will move to something else next year.

The support could improve, it takes a long time for a response. The service we received was poor.

I am using Checkmarx in parallel with SonarQube.

We didn't like how long they took to implement the product. The installation was not intuitive. We were constantly having meetings and installation additional things.

The implementation process should improve.

We were helped by both the local partner and the vendor for the implementation.

We have two developers for the maintenance and support of Checkmarx.

We're using a commercial version of Checkmarx, and we paid for the solution for two years. The price is high and could be reduced.

The local distributor charges two times higher than in other countries.

The purchase of this solution was a mistake.

I would advise others to deploy the solution and to test all of the functionality before buying and do not trust the marketing from Checkmarx.

I rate Checkmarx a four out of ten.

We are using it for static security scanning and static security testing. We also use it for code dependency analysis. We use two of the solution's tools for each variable.

The support the solution offers is very good. When we were evaluating tools, they were extremely helpful. They're always available and they always respond back to any queries.

The solution is always updating to continuously add items that create a level of safety from vulnerabilities. It's one of the key features they provide that's an excellent selling point. They're always ahead of the game when it comes to finding any vulnerabilities within the database. I am able to be assured that when I am scanning my product those vulnerabilities are identified at very initial stages. It gives my development team more time to react.

The particular way the tool works for the scanning at the IDE level, is very expensive. It makes it very expensive to deploy this tool on to multiple different developers' machines. Right now, the way it scans, the request is raised to the IDE of the developer but then the actual scanning gets done in the centralized scan server. This increases the load on the scanning server and that will make it difficult to use Checkmarx at the developer end. That forces me to look for another solution for implementing at the developer IDE level. I would strongly recommend Checkmarx relook into their approach. 

From a technical point of view, it's better to integrate with other systems within my ecosystem. For example, when I'm connecting Checkmarx with my DevSecOps pipeline and then wiring Checkmarx with other security systems as well as the pipeline (and my defect management system), it provides the connectivity to some of the tools, but there are tools which are excluded. It would be nice if they were added to the solution itself, otherwise, it requires us to do custom development.

In terms of dashboarding, the solution could provide a little more flexibility in terms of creating more dashboards. It has some of its own dashboards that come out of the box. However, if I have to implement my own dashboards that are aligned to my organization's requirements, that dashboarding feature has limited capability right now. I would recommend much more flexibility in terms of dashboarding to help us customize more effectively.

Their licensing model is rigid and difficult to navigate.

I haven't been dealing with the solution for that long. We've only used it for one quarter - about three months.

Their licensing fees are rigid and this causes two main issues. One is a restriction in terms of scaling the product at an enterprise level. The number of licenses required for a sizable business is just too large. The solution forces a user to apply for the licenses not directly to the software and the software products are defined in a curious way. For that reason, I wouldn't say it's great at scaling.

So far, technical support at the initial level has been decent. We paid for their protection services, and, the protection tool is definitely very expensive. However, with the price tag comes more support and service. 

We'll have to see in the coming quarters once the protection services end if the support will continue to be at such a high level of attention.  

We were using AppScan. Checkmarx is much better than that particular tool. It has more functionality and offers much more support to its users.

It took about two to three days to deploy a basic portion of the solution. However, it takes more time in terms of configuring and fine-tuning the product so that it's useable. I would say it took us about two to three weeks of configuring before we could start our initial scans.

We bought that separate service from Checkmarx to help us out in terms of deploying and configuring the products.

This solution is definitely one of the more expensive tools. However, if I'm able to get value out of using it, I don't mind paying. 

They have protection services costs that are separate from the main license.

There are multiple components that are part of the product suite and there are different license costs for each of those components. Sometimes it can be a little difficult to understand. There are a lot of components an individual will need to buy to cover an organization's needs. It really should be more transparent and flexible. Their licensing model as of today is quite rigid. 

We're just a customer. We don't have a special relationship with the company.

I would definitely recommend Checkmarx, I find them much more feature-rich than other tools I've used in the past. 

I'd rate the solution eight out of ten.

We use the product for static code analysis, supply chain, and container security.

The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility.

The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform.

We have been using Checkmarx's on-premise version for four years. We switched to the cloud version recently.

I rate the product's stability a nine or ten out of ten.

We have 40 Checkmarx users in our organization. I rate its scalability a nine out of ten.

The technical support team promptly addresses the issues.

The initial setup process is easy.

I rate Checkmarx an eight out of ten.

We use the solution for our international customers.

The UI is user-friendly.

The Fast feature for static application security testing is the most valuable.

The plugins for the development environment have room for improvements such as for Android Studio and X code.

I have been using the solution for two months.

I give the stability a seven out of ten.

I give the scalability a nine out of ten.

The scalability is based on the number of licenses. We currently have five licenses.

The technical support is quick to respond.

Positive

I give the initial setup an eight out of ten. The deployment takes about ten minutes.

The implementation was completed by a consultant.

The solution is costly. I give the solution a six out of ten for price.

I give the solution a nine out of ten.

Checkmarx is used for application security, we can detect the stability and other details on how to fix issues.

The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results.

Checkmarx could improve the speed of the scans.

I have been using Checkmarx for approximately half a year.

We have five people in our company that uses Checkmarx, we do not plan to increase usage.

I have used the support from Checkmarx.

I have not used another before Checkmarx.

The initial setup of Checkmarx was very easy. The process took approximately one hour. We only need to provide information.

We have five people that are supporting Checkmarx in our company.

This solution is one of the easiest solutions I have used. We have professional services set it up for us but the scans are not enough for us.

I rate Checkmarx an eight out of ten.

We use it for code scanning and security testing for our in-house application development. We are using its latest version.

Apart from software scanning, software composition scanning is valuable.

Its user interface could be improved and made more friendly. 

When we change a window, the session times out, and we have to log in again. It can be improved from this aspect.

I have been using this solution for about one year.

It has been stable during our work.

We don't have so many applications. So, I have no idea about its scalability. It is enough for our work at the moment, and we have not had any problem with its scalability.

In our team, we have about 10 users.

We are just users of this solution. There is another team that interacts with them. They get technical support from the vendor on this. 

In my previous company, I used SonarQube. In my opinion, Checkmarx gives better results, and its protection is better than SonarQube.

Another team takes care of its deployment. We are just users. We just log into the server and use it for scanning.

It has been working well. I would rate it a seven out of 10.

We are using Checkmarx for application code scanning, such as scanning for different leverages in the application code.

The solution has good performance, it is able to compute in 10 to 15 minutes. 

Checkmarx could improve the REST APIs by including automation.

I have been using Checkmarx for approximately one year.

Checkmarx is stable.

The scalability of Checkmarx is good, we can onboard easily.

We have approximately 200 people in my organization using this solution.

I have not contacted technical support. We have not required it.

I have used SonarQube previously.

The installation is straightforward and takes approximately 40 minutes.

I am able to do the implementation myself.

We have administrators and engineers that support and maintain the solution.

We have purchased an annual license to use this solution. The price is reasonable.

I rate Checkmarx a nine out of ten.

Checkmarx is used only for static application security testing (SAST), and it can integrate very well with DAST solutions. So both of them are combined into an integrated solution for customers running application security.

I expect application security vendors to cover all aspects of application security, including SAST, DAST, and even mobile application security testing. And it would be much better if they provided an on-premises and cloud option for all these main application security features. So most of my customers would love to have consolidated vendors who cover all application security to lower operational overhead.

I'm a solution architect, not an end-user. I'm selling Checkmarx. This is the first year I've done business with Checkmarx. In the past five years, I worked a lot with Fortify and Micro Focus. I currently have two customers running Checkmarx, and one more is evaluating the product.

Setting up Checkmarx should be relatively straightforward. It takes a little more time for the DevOps team to enable everything, but overall deployment should take less than a week, including preparation and implementation. 

Most of my customers opted for a perpetual license. They prefer to pay the highest amount upfront for the perpetual license and then pay for additional support annually.

I rate Checkmarx eight out of 10. Until I get more extensive feedback from clients, I would rate it an eight.